--- title: "Automating SOC Alert Triage with Amazon Bedrock Agents" url: https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9 source_url: https://blogs.halodoc.io/from-siem-alerts-to-action-building-an-ai-powered-soc-with-amazon-bedrock-agents type: article source: "Halodoc" published: 2026-08-14T05:59:37.796Z updated: 2026-08-14T06:00:04.577Z tags: ["security", "ai-agents", "amazon-bedrock"] reading_time: 16 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Automating SOC Alert Triage with Amazon Bedrock Agents **[Halodoc](https://daily.dev/sources/halodoc)** · 16 min read · 0 upvotes · 0 comments ## Summary Halodoc built an AI-driven SOC alert triage system using Amazon Bedrock Agents integrated with an OpenSearch-based SIEM. Three domain-specific agents (AWS, on-prem, and third-party security) automatically enrich alerts, correlate evidence, retrieve threat intelligence, and output a standardized JSON verdict (Summary, Severity, Recommendation, Tags). High-confidence incidents escalate to Tier-2 via Jira/Google Chat, while eligible false positives auto-close with sampled human review. Model evaluation across Amazon Nova models found the smallest, Nova Lite, most accurate and cost-effective for this use case, outperforming larger models. In production, time to first investigation dropped from minutes/hours to seconds, coverage became 24x7, and the team processed 1,500+ alerts without queue backlog, while keeping humans in control of Tier-2 decisions and remediation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Which Amazon Nova model works best for automating security alert investigation with Bedrock Agents? Amazon Nova Lite, the smallest and most cost-effective model tested, produced the most accurate investigations when evaluated against larger Nova models. It correctly identified the highest-risk issue, returned a valid structured JSON response, and gave precise remediation guidance, outperforming larger models that generated more detailed but less accurate responses on the same alert payloads and context. _Teams weighing model size against accuracy for security automation can track real-world evaluations like this on daily.dev._ ### How much can AI-driven SIEM alert triage reduce time to first investigation compared to manual analyst triage? Time to first investigation dropped from minutes to hours under manual analyst-dependent triage down to seconds after alert generation with an AI-driven workflow. The AI-driven approach also enabled 24x7 continuous investigation coverage and processed over 1,500 alerts since launch without a queue backlog, versus a manual capacity of roughly 50-60 alerts per day. _daily.dev helps SOC engineers compare production results before adopting AI triage workflows._ ### What architecture is used to connect Amazon Bedrock Agents to a SIEM for automated alert investigation? An event-driven pipeline publishes OpenSearch Alerting events to an Amazon SNS topic, an AWS Lambda routing function inspects alert metadata to pick the right domain-specific Bedrock Agent (AWS, on-prem, or third-party security), and the agent queries OpenSearch via a VPC-scoped Lambda plus threat intelligence sources before emitting a structured JSON verdict with summary, severity, recommendation, and tags. _Engineers designing agent-based security pipelines can follow architecture patterns like this via daily.dev._ ## Similar posts on daily.dev - [Alert triage in under 3 minutes with Elastic's agentic SOC — Elastic Security Labs](https://daily.dev/posts/alert-triage-in-under-3-minutes-with-elastic-s-agentic-soc-elastic-security-labs-tnairkmjv) · Elastic Security Labs · 2 upvotes · 0 comments - [Automate model quota request and operational issue triage on Amazon Bedrock](https://daily.dev/posts/automate-model-quota-request-and-operational-issue-triage-on-amazon-bedrock-objak9jkv) · AWS · 0 upvotes · 0 comments - [How Harmonic Security improved their data-leakage detection system with low-latency fine-tuned models using Amazon SageMaker, Amazon Bedrock, and Amazon Nova Pro](https://daily.dev/posts/how-harmonic-security-improved-their-data-leakage-detection-system-with-low-latency-fine-tuned-model-doxfymu2i) · AWS · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#amazon-bedrock](https://daily.dev/tags/amazon-bedrock) [View this post on daily.dev](https://daily.dev/posts/automating-soc-alert-triage-with-amazon-bedrock-agents-kuxzq7qe9)